22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52

Analysis

max time kernel
16s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 19:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe
Size

1.9MB
MD5

3b6c6899d21f3832dd9432958248b923
SHA1

d9601a4ee5d73c76c78de03bb29a8dcf772e0d41
SHA256

22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52
SHA512

60f643e68f004aeeaa7a06431dc3f334ae5a65e068ebe7b27b239e1d4ed648f60955169edb3f279110747fa7ae0041acf8bb6524cea363c67b821517abf6ccf5
SSDEEP

49152:nWvXQjQuyueGCfOuuagkrZcFbSHgJFzHmEigd8:nYXcQuyxGCfmSOFbNJFTTigd

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

YShow3D.exe

pid process

2748 YShow3D.exe
Loads dropped DLL 3 IoCs

Processes:

22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exeYShow3D.exe

pid process

2644 22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe
2748 YShow3D.exe
2748 YShow3D.exe

pid	process
2748	YShow3D.exe

pid	process
2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe
2748	YShow3D.exe
2748	YShow3D.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

YShow3D.exe22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YShow3D.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

YShow3D.exe

pid process

2748 YShow3D.exe

pid	process
2748	YShow3D.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe

description	pid	process	target process
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe
PID 2644 wrote to memory of 2748	2644	22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe	YShow3D.exe

C:\Users\Admin\AppData\Local\Temp\22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe
"C:\Users\Admin\AppData\Local\Temp\22e14305d6791f077d7c9ab55c9c413e5fbb35a81a0fe3a48b4f21ca1e3dec52.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\YShow3D.exe
  C:\Users\Admin\AppData\Local\Temp\\YShow3D.exe /i ÕÒ²»µ½Ö¸¶¨µÄ¼ÓÃÜËø£¡ /t ÌáÊ¾ÐÅÏ¢£º /k 16
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\YShow3D.exe

Filesize
326KB

MD5
8e96277706fe70a9f910b7f85ea8eb92

SHA1
34ea5439c8711cb386e51520f9c4b05e6997c96f

SHA256
4f3dc8c71c652cf4ef4f0bf6d09f3272afb36df142e8eba1dd645efd4b1aca14

SHA512
3605cb71116db6fa12dae3727ce01d4f68f7afb5153b7575452c0e33861ddebdb33f9c3099f86d7625fb99b4d6fd548f60290a4b3cb9ad8e66d6d5bb50bcdbfa

Download Submit
memory/2644-7-0x0000000000C40000-0x0000000000FB9000-memory.dmp

Filesize
3.5MB

Download
memory/2644-6-0x0000000000775000-0x0000000000776000-memory.dmp

Filesize
4KB

Download
memory/2644-5-0x0000000000C40000-0x0000000000FB9000-memory.dmp

Filesize
3.5MB

Download
memory/2644-4-0x0000000000C40000-0x0000000000FB9000-memory.dmp

Filesize
3.5MB

Download
memory/2644-3-0x0000000000400000-0x0000000000779000-memory.dmp

Filesize
3.5MB

Download
memory/2644-2-0x0000000000400000-0x0000000000779000-memory.dmp

Filesize
3.5MB

Download
memory/2644-1-0x0000000000400000-0x0000000000779000-memory.dmp

Filesize
3.5MB

Download
memory/2644-0-0x0000000000400000-0x0000000000779000-memory.dmp

Filesize
3.5MB

Download
memory/2644-9-0x0000000000400000-0x0000000000779000-memory.dmp

Filesize
3.5MB

Download